Send it.
Forget it.
Whisper is an anonymous notes and files service. Every secret is encrypted with a key the server never stores, and it's gone the moment it's been read — or the moment its timer runs out.
Nobody can read it but the recipient
The default flow. You send plaintext, the server generates a random key, encrypts it, and discards the plaintext immediately. The key is returned to you exactly once, in the share link — if you lose it, nobody, including us, can ever recover the note.
Encrypt in the browser before sending, and the server stores your ciphertext as an opaque blob — it never sees a key at all. True end-to-end: not even a compromised server could read the note.
Every note, on your terms
Burn the note after a set number of reads. Default is 1 — the classic "read once and it's gone."
Or expire it on a timer instead, regardless of how many times it's opened.
Mixed directly into the encryption key via scrypt — a wrong password just fails to decrypt. There's no password hash sitting on the server to attack.
Restrict a note to a single IP, a CIDR range, or a comma-separated list — checked before any content is ever served.
No browser required
The API is open and built to work cleanly with plain curl — no
SDK, no auth, no JSON wrangling for file uploads.
curl -X POST https://api.whisper.beer/notes \
-H "Content-Type: text/plain" \
--data-binary "the launch code is 1234"
# response is JSON: id, key, and a ready-to-share url_decryptedcurl -X POST https://api.whisper.beer/notes \
-H "Content-Type: application/pdf" \
-H "X-Filename: contract.pdf" \
-H "X-Password: hunter2" \
-H "X-Views: 5" \
-H "X-TTL-Minutes: 60" \
--data-binary @contract.pdfcurl "https://api.whisper.beer/notes/ID?key=KEY" -o downloaded_file
curl "https://api.whisper.beer/notes/ID?key=KEY" -H "X-Password: hunter2"